@article {18655,
	title = {An evaluation of connection characteristics for separating network attacks},
	journal = {International Journal of Security and Networks},
	volume = {4},
	year = {2009},
	month = {2009/01/01/},
	pages = {110 - 124},
	abstract = {The goal of this paper is to evaluate the efficiency of connection characteristics to separate different attack families that target a single TCP port. Identifying the most relevant characteristics might allow statistically separating attack families without systematically using forensics. This study is based on a dataset collected over 117 days using a test-bed of two high interaction honeypots. The results indicated that to separate unsuccessful from successful attacks in malicious traffic: the number of bytes is a relevant characteristic; time-based characteristics are poor characteristics; using combinations of characteristics does not improve the efficiency of separating attacks.},
	doi = {10.1504/IJSN.2009.02343},
	url = {http://dx.doi.org/10.1504/IJSN.2009.02343},
	author = {Berthier,Robin and Michel Cukier}
}
